TUI: Remove core protocol dependency [3/7] (#20174)

## Why

This is part 3 of a 7-PR stack to remove direct
`codex_protocol::protocol` usage from `codex-tui` while keeping each
layer reviewable and shippable.

With `AppCommand` now explicit, the internal app event bus can carry TUI
commands directly instead of bouncing through core `Op` values.

## What changed

- Changed `AppEvent::CodexOp` and `AppEvent::SubmitThreadOp` to carry
`AppCommand`.
- Updated app-event senders and direct emitters to submit `AppCommand`
values.
- Adjusted tests to match `AppCommand` or convert back through
`into_core()` where they intentionally assert legacy payload equality.

## Verification

- `cargo test -p codex-tui --no-run`

codex-rs/tui/src/app_command.rs

@@ -2,6 +2,7 @@ use std::path::PathBuf;
 
 use codex_config::types::ApprovalsReviewer;
 use codex_protocol::approvals::ElicitationAction;
+use codex_protocol::approvals::GuardianAssessmentEvent;
 use codex_protocol::config_types::CollaborationMode;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary as ReasoningSummaryConfig;
@@ -104,6 +105,9 @@ pub(crate) enum AppCommand {
     Review {
         review_request: ReviewRequest,
     },
+    ApproveGuardianDeniedAction {
+        event: GuardianAssessmentEvent,
+    },
     Other(Op),
 }
 
@@ -186,6 +190,9 @@ pub(crate) enum AppCommandView<'a> {
     Review {
         review_request: &'a ReviewRequest,
     },
+    ApproveGuardianDeniedAction {
+        event: &'a GuardianAssessmentEvent,
+    },
     Other(&'a Op),
 }
 
@@ -450,6 +457,9 @@ impl AppCommand {
             Self::Shutdown => Op::Shutdown,
             Self::ThreadRollback { num_turns } => Op::ThreadRollback { num_turns },
             Self::Review { review_request } => Op::Review { review_request },
+            Self::ApproveGuardianDeniedAction { event } => {
+                Op::ApproveGuardianDeniedAction { event }
+            }
             Self::Other(op) => op,
         }
     }
@@ -568,6 +578,9 @@ impl AppCommand {
                 num_turns: *num_turns,
             },
             Self::Review { review_request } => AppCommandView::Review { review_request },
+            Self::ApproveGuardianDeniedAction { event } => {
+                AppCommandView::ApproveGuardianDeniedAction { event }
+            }
             Self::Other(op) => AppCommandView::Other(op),
         }
     }
@@ -716,11 +729,26 @@ impl From<Op> for AppCommand {
             Op::Shutdown => Self::Shutdown,
             Op::ThreadRollback { num_turns } => Self::ThreadRollback { num_turns },
             Op::Review { review_request } => Self::Review { review_request },
+            Op::ApproveGuardianDeniedAction { event } => {
+                Self::ApproveGuardianDeniedAction { event }
+            }
             op => Self::Other(op),
         }
     }
 }
 
+impl PartialEq<Op> for AppCommand {
+    fn eq(&self, other: &Op) -> bool {
+        self.clone().into_core() == *other
+    }
+}
+
+impl PartialEq<AppCommand> for Op {
+    fn eq(&self, other: &AppCommand) -> bool {
+        *self == other.clone().into_core()
+    }
+}
+
 impl From<&Op> for AppCommand {
     fn from(value: &Op) -> Self {
         Self::from(value.clone())